Extracted

• • Target

    2025-04-04_f0bcfd4e545b52853a54e3ab5a3737f1_black-basta_luca-stealer

  • Size

    15.0MB

  • MD5

    f0bcfd4e545b52853a54e3ab5a3737f1

  • SHA1

    d62461a95ff8bb1dc938a26d78a790a1c28f98e2

  • SHA256

    0893f5f44352bce8623e58159a2ef1553fb37056b5fbcc6d03ca5ae35fe03b7f

  • SHA512

    2813a4efa5a86a29b8303ef6f0829a2eacefa3b5b0cade717d6078e6ac0faaa791df8cea87a7d05735ed29f1a286d51aa195f5035fb572f987f22361b1516ee9

  • SSDEEP

    49152:F/Luuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuu1:F5

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1